Tor Browser Hardening (hardened malloc, firejail, apparmor) vs Web Fingerprint

[Patrick]

@HulaHoop

My goal is to fins out:

*If stacking Firejail and Apparmor us any better than just using firejail for TBB

@madaidan

It is. Firejail doesn’t offer nearly as good file path whitelisting than AppArmor does. Firejail also can’t do many things AppArmor can such as managing ptrace or signals.

It’s also good defense in depth. If there’s a vulnerability in Firejail which isn’t unlikely then AppArmor will still restrict the application or vice versa.

@Vincent43 thinks “no” (my summary of his opinion).

@Vincent43 closed this ticket . Therefore has write access to firejail upstream github repository. This makes the statement more authoritative.

Details here:

firejail / seccomp / More Options for Program Containment

There was technical elaboration in the same ticket. Vincent43: AppArmor sandbox is path based and uses whitelist approach by default. Firejail sandbox is also path based and uses blacklist approach by default. It also uses namesapces and rewrites some paths in sandbox which cause denials in AppArmor as you can see. The only case supported by firejail related to AppArmor is using firejail-default generic profile which shouldn’t cause issues. Users who want to use app specific profiles with fir…